The EU Just Regulated the Label on Your Cloned Voice, Not the Clone

A mark tells you a clip is synthetic. It says nothing about whether anyone had permission to make the clip.

Article 50 is the transparency chapter of Regulation (EU) 2024/1689, and 2 August 2026 is the date the chapter becomes applicable rather than the date somebody wrote it down. The mechanics, stated plainly enough to survive being quoted without the paragraphs around them:

• Article 50 does not stop voice cloning. From 2 August 2026 it requires synthetic audio to be marked and deepfakes to be disclosed, and it requires nobody's permission before a voice is copied. The AI Act entered into force on 1 August 2024 and arrives in stages under Article 113. Prohibited practices took effect on 2 February 2025. General-purpose AI model rules and the penalty regime took effect on 2 August 2025. Article 50 sits in the tranche that applies from 2 August 2026.

• Providers must mark the output. Systems generating synthetic audio, image, video or text must mark their outputs in a machine-readable format, detectable as artificially generated or manipulated.

• Deployers must disclose deepfakes. Anyone deploying a deepfake must disclose that the content is artificially generated or manipulated. Disclosure must be clear, distinguishable and accessible, at the latest at the time of first interaction or exposure.

• Intent is not an element. The deepfake duty needs no proof that anyone meant to deceive.

• A machine mark alone is not disclosure. The Commission's guidance is explicit that a deployer cannot discharge the deepfake duty by relying on an embedded machine-readable mark. A person has to be able to see or hear the disclosure, not only software.

• Fines reach EUR 15 million or 3% of total worldwide annual turnover, whichever is higher, under Article 99(4)(g). Article 99(6) reverses that for SMEs and start-ups, which face the lower of the two figures.

• No ownership, no consent test, no takedown. Article 50 creates no property in your voice, no requirement to ask you before cloning you, and no route to have an existing clone removed.

The definition confirms the shape of the rule. Article 3(60) defines a deep fake as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful. The Commission's guidance reads that as three cumulative tests: a high degree of similarity to the person or thing being simulated, a subject that exists or plausibly could exist, and content with the capacity to mislead about authenticity. Whether the maker meant any harm changes nothing about the duty.

A useful rule, and a narrow one. It removes the deceiver's alibi. Your consent is not part of the test at all.

There is exactly one place where the EU has now written a consent test into this territory, and the drafting is deliberately tight. The Digital Omnibus inserted two new prohibited practices into Article 5 of the AI Act. One bans systems that generate or manipulate realistic material showing an identifiable person's intimate parts, or an identifiable person engaged in sexually explicit activity, without that person's freely given, specific, informed, unambiguous and explicit consent. The other bans the generation of child sexual abuse material. Both apply from 2 December 2026. They are an absolute ban on a category of content, not a general right over your likeness. Outside intimate imagery, the AI Act still leaves the question of who may copy you to other law, principally national personality and image rights, and to data protection law where a voice constitutes personal data.

Europe has decided that a synthetic voice must confess what it is. Europe has not decided who the voice belongs to.

For the longer version of the second sentence, the split between your estate, the platforms and whoever holds your recordings is the piece to read next. If you want the practical layer instead of the statute, start with the steps that make your voice harder to clone in the first place.

Article 50 is one article with five operative paragraphs, and they bind different people. Coverage flattens all five into "AI must be labelled", which is how a reader ends up believing the rule protects them from a fake of their own voice. The duty that would do that work sits on a stranger who may never publish anything at all.

The marking duty in 50(2) and the disclosure duty in 50(4) are separate layers sitting on separate parties. The company that builds the voice engine owes the mark inside the file. The company that publishes the clip owes the sentence under the waveform. Neither one covers for the other.

The transitional relief is narrower than the headlines about the relief. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was adopted on 8 July 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It amends the AI Act's transitional provisions so that providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50(2) marking requirement. That relief covers the marking mechanism and nothing else. Systems launched on or after 2 August 2026 get no grace period. Every other Article 50 duty, the deepfake disclosure duty included, applies from 2 August 2026 regardless.

The same Omnibus deferred the high-risk system rules under Annex III from 2 August 2026 to 2 December 2027. If you have seen a headline saying the AI Act has been delayed, that is the delay being described. Article 50 was not delayed.

Enforcement is national. Member States designate market surveillance authorities, and those authorities investigate, order corrective action and impose penalties inside their own territory. The Commission's AI Act Service Desk publishes a directory of national contacts, including market surveillance authorities and national helpdesks, which is the fastest route to finding yours.

You also have a named right to complain. Article 85 provides that any natural or legal person with grounds to consider that the Regulation has been infringed may submit a complaint to the relevant market surveillance authority, without prejudice to other remedies. Not a right to compensation. Not fast. A real channel, though, and one that did not exist before 2 August 2026.

The Commission adopted its final guidelines on the Article 50 transparency obligations on 20 July 2026, less than two weeks before the obligations became applicable. They are non-binding, and only the Court of Justice can give an authoritative reading of the Regulation, but national authorities can be expected to work from them. None of this page is legal advice. If you run a company and need to know whether you are a provider or a deployer, read the Commission's guidelines and then pay a lawyer in your member state, because the answer turns on facts about your product that no article can know.

You may live in the EU. You may live in Manchester or Minneapolis and still record your voice into a product built by a company that sells into Europe.

Article 2(1) sets the scope in three parts that matter here. It covers providers placing AI systems on the market or into service in the Union, whether they are established in the Union or in a third country. It covers deployers established or located in the Union. And it covers providers and deployers located in a third country where the output produced by the AI system is used in the Union.

So a voice synthesis company in California or Sydney selling to European customers sits inside the rule. Building one product for Europe and a quieter one for everywhere else is expensive, and the marking layer tends to ship globally even when the obligation is regional. The same dynamic put GDPR consent banners on websites with almost no European visitors.

What does not travel is your standing. If you live outside the EU and someone outside the EU clones your voice for an audience outside the EU, Article 50 gives you nothing to point at. Your protection in that case comes from your own jurisdiction, which in the United States means a patchwork of state right-of-publicity and digital replica statutes, plus a federal bill that is not law and should not be described as though it were. The state-by-state digital replica laws show what a consent-based rule looks like where one actually exists.

The disclosure duty in Article 50(4) binds deployers, and a private individual acting personally is not a deployer.

Article 3(4) defines a deployer as a natural or legal person, public authority, agency or other body using an AI system under its authority, and then carves out use in the course of a personal, non-professional activity. Set that beside Article 50(4) and the consequence is plain. The colleague who makes a synthetic clip of your voice for a work presentation is a deployer and owes the disclosure duty. The acquaintance who makes the same clip at home and drops the file into a group chat is not a deployer and owes nothing under Article 50.

The person most likely to make a convincing fake of your voice is not a corporation with a compliance function. It is somebody who knows how you talk, who has your voicemail greeting on their phone, who knows the names of your children and the way you say them.

There are further carve-outs stacked on top. Article 50(4) requires only appropriate disclosure for evidently artistic, creative, satirical or fictional work, in a way that does not spoil the display or enjoyment of the work. Article 50(2) does not apply to assistive editing functions that do not substantially alter input data, or to certain law enforcement uses. Article 50(1) does not apply where the fact that you are talking to a machine is obvious to a reasonably well-informed person.

None of that makes the law weak. The target is the commercial and institutional flow of synthetic media, not the private one, and the commercial flow is where the volume sits. But if the person worrying you is an individual rather than a company, Article 50 is not your remedy, and your route runs through national law on defamation, harassment, data protection or image rights. Better to learn that this week than the week after somebody has already sent the clip.

Start building your legacy Free build, 50 memories, no card required.

Article 50(2) requires technical solutions that are effective, interoperable, robust and reliable as far as is technically feasible, taking account of the type of content, the cost of implementation and the acknowledged state of the art. It deliberately does not name a format. The engineering detail lives in the Code of Practice on Transparency of AI-Generated Content, published by the AI Office on 10 June 2026, and adherence to the Code is voluntary while the underlying Article 50 duties are not. The Commission is explicit on both halves of that. Signing is voluntary, and not signing is not in itself non-compliance, but a signatory whose adherence is assessed positively may rely on the Code to demonstrate compliance with Article 50(2), (3) and (5) whichever national market surveillance authority is the competent one. Companies that stay outside the Code can expect more requests for information about how they mark their output.

The Code sets out a layered approach: digitally signed provenance metadata attached to the file, imperceptible watermarking that survives ordinary re-encoding and cropping, and optional fingerprinting or logging against a registry. The metadata layer in practice means C2PA Content Credentials, the provenance standard maintained by the Coalition for Content Provenance and Authenticity. Which hands you something to do this afternoon, for nothing.

The first check is provenance. Take an audio or image file you believe was AI-generated, or one you generated yourself in a tool you are considering trusting with your voice, and drop the file into the Content Credentials Verify tool at verify.contentauthenticity.org. If the file carries a signed manifest, you will see who generated the content, with what software, and when. If the file carries nothing, you have learned something equally useful about the tool you were about to hand your voice to. Read a blank result carefully rather than as a verdict: the Code of Practice treats signed metadata and an inaudible watermark as two separate layers, so a file with no signed manifest may still carry a watermark that only the generator's own detector can read. What a blank result does tell you is that the easy, human-checkable layer is missing.

The second check is the contract. Read your voice tool's terms and find the clause about training. Marking describes what came out of the system and says nothing about what went in. The ownership terms buried in a voice product's contract are usually more consequential to you than the watermark on the file. You can also read what our own service actually includes before you record a second of audio.

Run both checks on us. Our answer to the first one is written out below, blank result and all.

Afterlife.ai™ synthesises voices, so this rule is aimed squarely at products like ours. What follows is stated plainly enough that you can hold us to the wording.

A guide called Idy interviews you. Your answers become the memories we build from, and your own recordings become the cloned voice those memories are spoken in. Personas here speak only in a voice their owner recorded, from material their owner gave, and they never invent what was not said. You nominate the people who may ever hear that voice. We add nobody, and there is no default list.

Release runs through Executor Lock™. A nominated person requests release, evidence is verified, and a seven-day window runs before anything opens. During that window you can stop the process. You consent to the gate in advance, and the evidence is checked at the moment somebody tries to use the gate. Article 50 requires none of that of anyone, and we treat the gate as the real protection. How the seven-day evidence-verified gate works in detail is documented separately.

On the transparency duties themselves, this is where we actually stand as of 30 July 2026, rather than the flattering version. Synthesis runs through ElevenLabs, which says it embeds an inaudible SynthID watermark in the audio it generates and publishes a free detector anyone can run. That is their marking rather than ours, and we have not independently verified the mark on every request. We do not yet attach our own signed provenance manifest, the Content Credentials layer described above, to the audio we hand you, so a Content Credentials check on a file from us comes back blank today. Our system was on the market before 2 August 2026, which puts that marking work inside the transitional period the Digital Omnibus set, running to 2 December 2026. We are treating that date as a deadline, not as cover. What we will not do, on any date, is sell a way to strip the marking, or a way to hide from a listener that a voice was synthesised. Nobody should be able to buy that silence.

Now the limits, because a claim without a limit is marketing. No marking layer holds under every condition. Signed metadata tends to be lost when a file is re-encoded, transcoded or stripped in transit, which is exactly why the Code of Practice asks for an imperceptible watermark underneath, and even that layer is only required to be robust as far as is technically feasible. True of every product in this category, ours included. Any company promising you an unbreakable mark is wrong about that promise. The second limit is the gate itself. Executor Lock™ verifies evidence and holds a seven-day window, which controls who opens the door. Once a nominated person is listening, we cannot control what they record on the other side of the screen. We would rather write that sentence down than have you discover the gap yourself.

Two more honest edges, since you came here to audit us. You can export your own material at any time, and the export hands you your details, every memory and every conversation as a file you keep, so the written record is not held only by us. Audio is the gap in that export: what you get is text rather than your recordings. And Personas depend on a running service, so ask every company in this category for its shutdown position in writing, ours included, and treat a vague answer as an answer.

The ethics of running AI Personas of people who have died is the argument underneath the statute, and it is the argument we had to answer before we wrote a line of the product.

A compliance date only tells you what a company was made to do. Article 50 will make an entire industry put a sentence under a waveform, and not one word of that sentence is about permission.

So the standard has to come from somewhere else. Every company in this category should state in public what its consent gate is, who can open the gate, and what evidence is required to open the gate. Ours is written above, including the parts that are not finished. We would like to read yours.

For you, the version of this technology worth having is the one built on purpose. Your voice, recorded by you. Your memories, chosen by you. A list of people you named yourself, and a gate you set before anybody needed the gate. An AI trained only on what you actually said starts from your consent instead of routing around the question. If the labelling side is what you came for, the practical follow-on is how you would demonstrate that a recording of your voice is genuinely yours, which is the same provenance question pointed in the opposite direction.

Fifty memories, free, no card, and the free build never expires. That last part is deliberate. The worst version of this industry is the one that charges a grieving family at the moment they are least able to refuse.

Europe has made synthetic voices announce themselves. Only you can decide that one of them speaks with your permission.

Start building your legacy Free build, 50 memories, no card required.

Does Article 50 stop someone cloning my voice without asking me?

No. Article 50 is a transparency rule. It requires that synthetic audio be marked in machine-readable form and that deepfakes be disclosed to the audience, from 2 August 2026. It does not require anyone to obtain your consent before cloning you, and it gives you no takedown right. The one consent-based prohibition the EU has added covers non-consensual intimate imagery, applying from 2 December 2026, and does not extend to voice generally.

I live outside the EU. Does any of this reach me?

Indirectly. Under Article 2(1), the AI Act covers providers placing systems on the EU market wherever they are established, and providers or deployers in third countries where the system's output is used in the Union. Most global tools will ship one compliant product rather than two, so you will probably see the labels. Your legal standing is a different matter, and outside the EU you would rely on your own jurisdiction's rules.

What if someone strips the watermark off?

You have a harder evidential problem, and who has broken what depends on who stripped the mark. Article 50 binds providers and deployers, so a private individual re-encoding a file to shed its metadata is not breaching Article 50 at all, though the Code of Practice asks signatories to prohibit exactly that in their terms of service. A company that strips the mark and then publishes the clip is a deployer publishing an undisclosed deepfake, and that does breach Article 50(4). On the engineering: marking under Article 50(2) has to be effective and robust only as far as is technically feasible, which is a standard rather than a guarantee. The Code layers signed metadata with imperceptible watermarking precisely because metadata tends to be lost when files are re-encoded or transcoded, while a watermark has to withstand ordinary processing such as cropping, compression and format changes. Neither layer is unbreakable, and enforcement rather than prevention is the law's answer.

My friend made a fake clip of my voice as a joke. Does the law cover that?

Almost certainly not. The disclosure duty in Article 50(4) applies to deployers, and Article 3(4) excludes use in the course of a personal, non-professional activity. A private person acting privately is not a deployer. The tool they used is still covered by the provider marking duty, so the file may carry provenance data. Your remedy against the person would come from national law on defamation, harassment, data protection or image rights.

Can I report a company that is not complying with Article 50?

Yes. Article 85 lets any person with grounds to believe the Regulation has been infringed complain to the relevant market surveillance authority, alongside any other remedy. Enforcement is national, so you complain to your member state's designated authority rather than to Brussels. The Commission's AI Act Service Desk publishes a directory of national contacts, which is the practical starting point for finding the right body.

Can I try Afterlife.ai™ without paying, and can I delete everything afterwards?

Yes to both. You can build with 50 memories, free, with no card asked for, and that free build never expires. You can then delete your account, which removes your Personas, your memories, your photos and the audio you recorded. Deletion takes out the stored recordings themselves rather than only your access to them, and it is available to you while you are alive on every plan we run. One limit worth naming, because you asked about everything: that single action clears our own stores, while the trained voice model held at our synthesis provider is a separate removal step. Ask for that one explicitly if it matters to you.

This page works from primary sources: the consolidated text of Regulation (EU) 2024/1689 article by article, Regulation (EU) 2026/1744 as published in the Official Journal, the European Commission's own FAQ and its July 2026 transparency guidelines, and the AI Office Code of Practice on Transparency of AI-Generated Content. The three-second figure comes from the published VALL-E paper rather than a vendor claim. Every date and penalty figure here is quoted from the instrument, not from press coverage. The statements about our own product describe what the software does as of this review, including the places where it does not yet do something.

What is not settled: the Commission's guidelines and the Code of Practice are both non-binding, so no court has yet ruled on what counts as an effective mark, on where the line falls between an assistive editing tool and a generative one, or on how far the personal-use carve-out stretches. National enforcement practice does not exist yet, because the obligations only start on 2 August 2026. Treat the interpretive parts of this page as the best current reading, not as a decided question.

Found something here that is wrong or out of date? Report an error in this page and we will check the claim against the source, correct the text and note the change.

• Who controls your face and voice after you die sets out the four parties who hold the decision, which is the layer Article 50 leaves untouched.

• What the NO FAKES Act would cover if it ever passes is the closest United States analogue, and the contrast with Europe's transparency-first approach is instructive.

• The state-by-state digital replica laws in the US show what a consent-based rule looks like when it does exist, which Article 50 is not.

• Whether voice cloning is safe to use at all covers the practical risks of handing your voice to any product, regulated or otherwise.

• Regulation (EU) 2024/1689 (EU AI Act), Article 50, Transparency obligations for providers and deployers of certain AI systems. artificialintelligenceact.eu/article/50

• Regulation (EU) 2024/1689, Article 2 (scope), Article 3(4) and 3(60) (definitions of deployer and deep fake), Article 85 (right to lodge a complaint), Article 99(4)(g) and 99(6) (penalties), Article 113 (application dates). artificialintelligenceact.eu/article/113

• European Commission, FAQ: Transparency obligations under Article 50 of the AI Act, Shaping Europe's Digital Future. Confirms application from 2 August 2026, the grace period to 2 December 2026 for previously released systems, the cumulative deepfake criteria, and that deployer disclosure must be understandable and perceivable by people rather than only machine-readable. The Commission's Article 50 guidelines are the source for the assessment turning on the capacity to mislead rather than on the deployer's intention to deceive. digital-strategy.ec.europa.eu

• European Commission, Guidelines on transparency obligations for providers and deployers of certain AI systems, adopted 20 July 2026, non-binding. digital-strategy.ec.europa.eu, adoption date confirmed at nicfab.eu

• European Commission and AI Office, Code of Practice on Transparency of AI-Generated Content, published 10 June 2026, voluntary. digital-strategy.ec.europa.eu

• European Commission, FAQ: Signing the Code of Practice on Transparency of AI-generated Content. Source for signing being voluntary, for non-signature not amounting to non-compliance, and for signatories being able to rely on the Code across competent market surveillance authorities. digital-strategy.ec.europa.eu

• IPTC, European AI Office releases Code of Practice on Transparency of AI-Generated Content. Source for the three marking mechanisms (digitally signed metadata, imperceptible watermarking, optional fingerprinting or logging against a registry) and for measure 1.2 on retaining metadata and prohibiting stripping in terms and conditions. iptc.org

• ElevenLabs, Detecting audio generated by ElevenLabs with SynthID. Source for the vendor's own statement that its generated audio carries an inaudible watermark and that a free detector is published. elevenlabs.io/blog/synthid

• Regulation (EU) 2026/1744 (Digital Omnibus on AI), adopted 8 July 2026, published in the Official Journal 24 July 2026, entered into force 27 July 2026. Amends Regulation (EU) 2024/1689 to defer Annex III high-risk obligations to 2 December 2027, to add Article 5 prohibitions on non-consensual intimate imagery and CSAM applying from 2 December 2026, and to give providers of generative systems already on the market until 2 December 2026 for Article 50(2) marking. eur-lex.europa.eu/eli/reg/2026/1744 and summary at nicfab.eu

• European Commission, AI Act Service Desk and Single Information Platform. The National resources section lists each member state's market surveillance authorities, notifying authorities and national helpdesks. ai-act-service-desk.ec.europa.eu

• Content Credentials Verify, Coalition for Content Provenance and Authenticity (C2PA), free in-browser provenance inspection. verify.contentauthenticity.org

• C. Wang, S. Chen, Y. Wu et al., Neural Codec Language Models are Zero-Shot Text to Speech Synthesizers (VALL-E), Microsoft, arXiv:2301.02111, January 2023. Source for synthesis of a personalised voice from a three-second enrolled recording. arxiv.org/abs/2301.02111

Last reviewed: 30 July 2026. This page carries regulatory claims with hard dates and is on a 30-day recheck cycle until the Article 50 position settles. Next scheduled review: 29 August 2026.